Tools
Password Generator
Generate a strong random password in your browser. Choose the length and which character types to include, and see how much entropy the result carries. Nothing is sent to a server.
How to use this tool
- Set the length. Sixteen characters or more is a sensible target for accounts that matter.
- Choose which character types to include.
- Copy the password, or generate another until you get one you are happy with.
Formula
Entropy (bits) = length × log₂(pool size)
- length
- number of characters in the password
- pool size
- how many distinct characters are available to choose from
Under 40 bits is weak, 60 to 90 is strong, and above 90 bits is very strong for any practical purpose.
Worked example
A 16-character password using lowercase, uppercase, numbers and symbols.
- Pool size26 + 26 + 10 + 25 = 87 characters
- Bits per characterlog₂(87) ≈ 6.44
- Total entropy16 × 6.44
About 103 bits of entropy, which is very strong.
What makes a password strong
Strength comes from unpredictability, not from cleverness. Substituting a 3 for an e or adding an exclamation mark at the end follows patterns that password-cracking tools try first. Length and randomness are what actually matter.
Entropy measures this in bits. Each extra bit doubles the number of possibilities an attacker must try. A random 16-character password using all four character types carries over 100 bits, which is far beyond what brute force can reach.
How these passwords are generated
Characters are drawn using your browser's cryptographically secure random number generator, the same facility used for cryptographic keys, rather than the ordinary pseudo-random function. The generator also uses rejection sampling so that every character in the pool is equally likely, avoiding the slight bias a simple modulo would introduce.
At least one character from each selected type is guaranteed, and the positions are then shuffled so the pattern is not predictable.
Use a password manager
A strong password is only useful if it is unique to one account, and nobody can remember dozens of random strings. A password manager generates, stores and fills them for you, so the only password you need to remember is the one that unlocks it.
Turn on two-factor authentication wherever it is offered. It protects an account even if the password is exposed in a breach elsewhere.
Things to keep in mind
- Passwords are generated on your device and are never transmitted, logged or stored by this site.
- Some websites reject certain symbols. If a password is refused, generate one without symbols and increase the length instead.
- Never reuse a password across accounts, however strong it is.
Frequently asked questions
Is it safe to generate a password on a website?
It depends entirely on where the generation happens. This tool generates passwords in your browser using the Web Crypto API, so the password never leaves your device and no server ever sees it. You can even disconnect from the internet after the page loads and it will still work.
How long should my password be?
Sixteen characters is a good general target, and longer is better for important accounts such as email and banking. Length adds more strength than complexity rules do.
Should I exclude look-alike characters?
Only if you will have to read or type the password manually, for example to enter it on a television or dictate it over a phone. Excluding them slightly reduces entropy, so leave them in when a password manager will handle it.
Was this calculator useful?
Quick reaction, a note, or both — whatever's useful to you.
Contact details are optional and only used to reply to you — never shared, never used for marketing.